The site is run by Canadian company Avid Life Media, which operates a portfolio of similarly niche and controversial dating sites, including Cougar Life (for older women seeking younger men) and Established Men (“Connecting young, beautiful women with interesting men”).

How does the site work?

Unlike many dating sites, Ashley Madison does not charge for membership directly. Instead, users pay for credits, which are used to send messages and open chat sessions. Controversially, the site charges men to send messages to women, and also charges men to read messages sent by women. While many dating sites tilt the scales in favour of female members, few are as explicit about doing so.

Users can also use their credits to send gifts, or pay more to put their message at the top of a (female) members inbox.

Ashley Madison using copyright law to try to limit attack leak

Read more

What’s been stolen?

The site’s database of members, as well as a huge amount of internal corporate data. The database is split into three parts: the largest contains profile information, including the names, street addresses, and dates of birth of users.

That database also contains the users’ entries in three checkbox lists, variously detailing their turn-ons, what sort of person they’re looking for, and what acts they’re hoping to perform, as well as biographical information such as whether or not they smoke and drink.

A second database contained the users’ email addresses, as well as information about what mailing lists they were opted-in to. This is the database which has been the source of many of the stories up till now, because it is the easiest to search in general terms. Unsurprisingly, users have signed up with email addresses from the UK and US governments and militaries, as well as a number of large corporations and educational establishments – although, despite reports to the contrary, no-one has signed up with a valid email from the Vatican.

But the email database is questionable. Understanding its members’ needs for privacy, Ashley Madison did not require an email to be confirmed before the account could be used, leading to some members signing up with obviously false emails (such as “tblair@labour.gov.uk”, an address that doesn’t exist), and others gave emails that weren’t their own, such as the multiple accounts created with “steve@apple.com”.

The third is a database of credit card transaction information. But the information isn’t enough to steal users’ cash, and Ashley Madison has been very clear that full credit card information wasn’t leaked, saying:

“No current or past members’ full credit card numbers were stolen from Avid Life Media. Any statements to the contrary are false. Avid Life Media has never stored members’ full credit card numbers.”

Ashley Madison hackers release vast database of 33m accounts

Read more

What if the account was deleted?

Some of the information from deleted accounts remains in the database. This is true even for accounts which appear to have been deleted with Ashley Madison’s paid-for “full delete” option, which charged £15 or $20 to remove all of a user’s information from the site. The Guardian has found that some accounts, labelled as “paid delete” on the database, retain enough information to identify the account holder: specifically, a longitude and latitude derived from the post or zip code, as well as the date of birth, height, weight and gender.

Where is the information now?

The main dump is hosted on a Tor “hidden service” – a website which can only be accessed through the anonymous browser. Unlike a normal website, which visitors connect to directly, a hidden service is accessed via an encrypted connection routed through third-parties which obscure the website’s address from its visitors, and vice-versa. That means that it’s very difficult to use the legal system to take down the main dump, since no-one yet knows who to send the takedown notices too.

On top of that, the dump itself is now being disseminated using bittorrent, a peer-to-peer transfer protocol. The file is broken up into multiple blocks, which are then shared directly from one downloader’s computer to the next. With no central repository, it is all but impossible to prevent the transfer, although a “magnet” link – a short string of text telling a new downloader how to connect to the “swarm” of files – is still required.

Who did it?

So far, no one knows. On the day of the hack, Ashley Madison’s chief executive Noel Biderman told security reporter Brian Krebs that it might have been an inside job. “We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” Biderman, said. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.”

But since then, nothing more has been revealed by Ashley Madison, except for the fact that the firm is investigating the attack. In its most recent statement, the company said: “We immediately launched a full investigation utilising independent forensic experts and other security professionals to assist with determining the origin, nature, and scope of this attack. Our investigation is still ongoing and we are simultaneously cooperating fully with law enforcement investigations, including by the Royal Canadian Mounted Police, the Ontario Provincial Police, the Toronto Police Services and the US Federal Bureau of Investigation.”

What can I do if my details appear on it?

Given the widespread availability of sites which will allow the curious to check whether a given email address was included in the hacked data, if you know your information was on the site, you should prepare for it to become public sooner or later.

That said, the mere fact that a person’s data was included in the leak does not mean that they used the site to have an affair, says Tod Beardsley of information security firm Rapid 7. “For starters, it’s trivial to set up a fake account on Ashley Madison, since Avid Life Media’s (ALM’s) account setup procedures encourages, but does not require, an e-mail address to be verified by the user. This might be done for a variety of reasons by actors ranging from pranksters to bitter divorce rivals.

“Second, the majority of “real” account holders tend to use fake, throw-away data and details, for obvious reasons. If some of those fake details happen to coincide with a real person, then it can create a sticky problem for that real person.

“Finally, even if the real data is a real person, and that person really registered for the site, there is no indication in the data if that person was successful at, or even intending to, pursue an illicit affair.”

What repercussions will the site face?

It could find the breach will be very costly indeed, says Luke Scanlon, technology lawyer at Pinsent Masons: “The interesting thing about this incident is that recent court decisions in the UK have been leaning towards the view that a claim can be brought when no financial loss occurs but where a person experiences distress as a result of an data breach.

“In the case of Ashley Madison, which is reported has 1.2m subscribers in the UK alone, if each were to try to claim for £1,000 in compensation Ashley Madison could see itself incurring costs of up to £1.2bn. Even if claims for distress in this case are modest, the sheer volume of data breached and individuals affected in this attack could have a critical impact on the company.

“This event reinforces the need for businesses to not just think about what is mandatory by law in information security, but what is best practice.”